Confessions of a Microsoft Consultant : Tips

Converting Windows Error Codes To Something More Friendly

Daniel Oxley — Thu, 05 Nov 2009 09:30:24 GMT

I can never remember how to do this, so I always end up looking it up. Therefore, I am posting it here partly for me as a reference, but also in case anyone else finds it useful :-)

Sometime the error codes that are returned by Microsoft Windows are accompanied by a rather cryptic message, or the message doesn’t quite offer enough information to be able to work out what has happened. Well, if you follow the steps below you can look up what the message means to Windows, based on the error code that was returned.

Make note of the last four numbers of the hexadecimal error code, in this example it is 2AFC.

Open the Windows Calculator (calc.exe) and switch it to the Scientific mode (or Programmer mode if you are using Windows 7). Select the Hex radio button, then enter the last four digits of the hexadecimal error number.

Select the Dec radio button, and you’ll see the hexadecimal number converted to a decimal one.

Open a command prompt (cmd.exe) and type the following command: “NET HELPMSG ” followed by the decimal number that appears in the calculator. In this case, the command would be: “NET HELPMSG 11004”. You will then be returned what is hopefully a more friendly version of the error message.

Note that this will only work for Win32 error codes that originate from Microsoft Windows, the codes will often start with 8007 but not always. Also, if the net helpmsg command does not return a result it most likely means that the error either did not originate from Windows, or is not a valid Win32 process.

Ooops, that’s not right…

Daniel Oxley — Thu, 29 Oct 2009 09:51:06 GMT

I have been asked twice this week if this is possible and if so how to do it, so I guess either the information is not readily available on the Internet, or the two people who asked me just couldn’t be bothered to look it up...!

I’m sure you’ve seen the below screen appear during the first boot of your computer or server after you have installed any updates in Windows 7 or Windows Server 2008 R2, it’s the screen that says “Completing stage X of Y”.

It is during this phase that, amongst other tasks, any files that were in use while the update was being applied are now copied into their right place and updated once the computer was rebooted. On very rare occasions you might one day see that the computer has gotten stuck at the above screen, and the configuring of the update(s) never completes. This creates a dilemma because you want to get access to the console so that you can work out what went wrong, but this will require a hard reset of the computer. However, on the screen in clear text it is telling you not to turn off your computer.

This issue might occur for several different reasons, which are way outside my field of expertise so I won’t try to explain them here. Thankfully, there is a solution for Windows 7 and Windows Server 2008 R2 that permits you to rollback the changes made by all the updates you applied during the last update. Simply use the below steps to recover your non-booting system:

Boot the computer into the Windows Recovery Environment (WinRE) by either using the installation media or pressing F8 during boot (WinRE is built in to OS installations now).
Open a command prompt.
Navigate to the \Windows folder that you wish to repair.
Run the command: DISM /image:DRIVE LETTER OF WINDOWS DRIVE\ /cleanup-image /revertpendingactions

An example of this command might be: DISM /image:C:\ /cleanup-image /revertpendingactions

A message should then appear saying

Reverting pending actions from the image....

The operation completed. Any revert of pending actions will be attempted after reboot.”

When you restart the computer you will now see a different screen, this time saying "Reverting pending actions". Once this process has completed, any changes that the previous update(s) made should now be reversed and you should be able to log on correctly.

Wallpapering your Windows 7 computer

Daniel Oxley — Mon, 26 Oct 2009 09:28:10 GMT

As some of you may know, certain countries have personalisation packs for Windows 7 that are activated on during the installation of the operating system, depending on the regional settings you first set. So, if you tell Windows 7 setup that you are in the United Kingdom, one of the wallpapers that will be available to you is a photo of Stonehenge. But what if you want to see all the other wallpapers that are available in other regions? Well, you can either go fetch them out of the Windows installation folder, or follow the below steps to make them appear in the desktop personalisation section of Control Panel!

Open Control Panel
Click Clock, Language, and Region
Click Region and Language
Click on the Location tab
Select the following locations, pressing Apply after each one:
- Australia
- Canada
- South Africa
- Spain
- United Kingdom
- United States
Reset the location back to the correct one, and press OK.

Now you can right click on the desktop and choose Personalise from the menu. In the Desktop Backgrounds section, you’ll see some new backgrounds! Note that not all countries have their own personalisation packs, the only ones I know of are the ones listed above.

Putting iexplore.exe on a diet

Daniel Oxley — Wed, 14 Oct 2009 08:19:34 GMT

I have gotten very used, very quickly, to the excellent tabbed browsing feature that was introduced with Internet Explorer 7. This feature was tweaked a fair bit for Internet Explorer 8, but the most noticeable change is that now each tab opens in a separate memory process; this really is great because if the content of one of the tabs causes a crash in iexplore.exe, it won’t cause all the other tabs to crash meaning you lose everything that you had open. The downside of course is that by having each tab in a separate process, more system memory is consumed – not a problem if you have plenty of memory to spare, but my Anti-MS brother always complains to me about how slow his computer is, even though it only has 128mb of RAM and runs Windows XP plus 300 other applications simultaneously. Of course, his lack of RAM has nothing to do with the system performance, but rather it is the fault of the operating system – or so he insists (but then he actually believes that VMware ESXi is “just sexy”, so I don’t listen too much).

Anyway, if you want to reign in the memory usage of iexplore.exe a little, you can tweak some settings in the registry. Changing these will cause, amongst other things, iexplore.exe not to start so many separate processes; a useful tip to save a bit of system memory if you are a bit short but at the cost of potentially losing all open tabs if the content of one of them caused a crash.

I saw these tweaks over on the AskIE blog, where they do a pretty good job of explaining what each one does. have included their explanation below:

HKCU\Software\Microsoft\Internet Explorer\Main - TabProcGrowth (string or dword)

Tab Process Growth : Sets the rate at which IE creates New Tab processes. There are two algorithms used by Internet Explorer.

1. Context-based: By default, the context-based algorithm is used and the curve is chosen based on the amount of physical memory on the machine. In addition, the TabProcGrowth string registry value may be manually forced to:

small: Maximum 5 tab processes in a logon session, requires 15 tabs to get the 3rd tab process.
medium: Maximum 9 tab processes in a logon session, requires 17 tabs to get the 5th tab process.
large: Maximum 16 tab processes in a logon session, requires 21 tabs to get the 9th tab process.

2. The "Max-Number" algorithm: This specifies the maximum number of tab processes that may be executed for a single isolation session for a single frame process at a specific mandatory integrity level (MIC). Relative values are:

TabProcGrowth=0 : tabs and frames run within the same process; frames are not unified across MIC levels.
TabProcGrowth =1: all tabs for a given frame process run in a single tab process for a given MIC level.

Note: On Terminal Server, the default value is the integer of 1.

TabProcGrowth >1: multiple tab processes will be used to execute the tabs at a given MIC level for a single frame process. In general, new processes are created until the TabProcGrowth number is met, and then tabs are load balanced across the tab processes.

Note: that the frame process is no longer allowed to execute at low-MIC. If this is attempted, the process will exit.

You may select the Max-Number algorithm by specifying the registry value as an integer. The registry value may be a string value containing an integer (e.g., "5") or a DWORD value containing an integer (e.g., 5).

In general, you have to restart IE to use a different TPG value.

Benchmarking Windows 7

Daniel Oxley — Tue, 06 Oct 2009 14:36:20 GMT

A very common request that clients make when starting a Windows deployment project is that we must reliably and accurately demonstrate that Windows Vista or Windows 7 is worth upgrading to from Windows XP, especially if the purchase of new hardware is not part of the project; often, and logically, clients will try to re-use their existing hardware platform whenever possible in order to save money. Consequently, I am regularly asked to prove that the newer version of Windows will run equally as well as Windows XP on the same hardware. Their reasoning being is that they won’t upgrade the operating system on the existing hardware if the end-user experience is worse in terms of performance – regardless of how good the new features of the operating system are. The problem with this is two-fold, one is a technical issue and the other is pure fantasy...

Attempting to benchmark and compare two different operating systems (yes, I know that each version of Windows is an evolution of the previous one, but it is still complicated) and providing accurate results is an extremely complicated task. Unless done right, the results can be often speculative and can be turned upside down purely on your point of view. It is also dodgy territory to get into because of the sheer number of factors that need to be taken into account in order for the test to be of any value, and then trying to explain the results to a lay person can be even more tricky. This is because benchmarking a computer is not simply about measuring the raw speed of the CPU, in the same way that the horsepower alone of a car cannot be used to gauge if one car is quicker than another – you need to consider other factors such as the weight, ratios of the gearbox and torque.

There are plenty of free tools that you can find on the Internet that will measure your computers speed, but more than a few are totally useless because they are simply measuring individual parameters such as CPU speed and RAM read/writes. To benchmark a computer properly you need something that will measure hundreds of different aspects of the computer’s hardware and the operating system installed onto it, in order to produce an reliable result; even things such as the BIOS software can have a profound effect on the results from the benchmarking tests.

Because this is such a hot topic, and given that Windows 7 is around the corner, Microsoft published some benchmarking guides so that you can start measuring right now the performance of your systems with Windows 7. I have included the link for the Windows 7 guide below, along with the (now defunct) Windows XP guide. The Windows XP guide is there because, after all, the only real way to gauge the performance of your system is when you compare it to a different operating system running on the exact same hardware.

Benchmarking on Windows XP: http://www.microsoft.com/whdc/archive/benchmark.mspx

Performance Testing Guide for Windows: http://www.microsoft.com/whdc/system/sysperf/Win7Perf.mspx

Oh, and the “pure fantasy” I mentioned earlier... Well, Windows Vista has had a somewhat “turbulent” life in terms of public perception. I have always honestly told clients that my personal experiences with Windows Vista have been excellent, and it has always been fast for me. Likewise, when I have worked on Windows Vista deployment projects this has also always been the case, the deployed computers always performed better than clients expectations. However, often when clients talked about benchmarking Windows Vista they were very dubious of the results and tended to disregard them purely because they had it in their head that Windows Vista was/is a terribly slow beast. Overcoming their personal views was actually extremely hard to do, regardless of how well benchmarking facts and statistics actually were.

Creating Your Own Search Provider in Internet Explorer

Daniel Oxley — Wed, 02 Sep 2009 12:08:49 GMT

For me, this is possibly one of the most overlooked, but invaluable, features of Internet Explorer 7 and 8. I actually only discovered it a few days ago, but I now use it pretty much daily.

First introduced with Internet Explorer 7, the Instant Search box in the top right-hand corner of the browser allows you to search the indexes of pages, such as bing.com and yahoo.com, without visiting the pages first. You enter your search terms into the box, initiate the search, and then the results page are displayed in the browser window. You can quickly customise the list of possible search engines, or you can even make your own ones.

Just follow the steps detailed below to create a new search provider, which you can then easily adapt to possibly any website you want to search.

From Internet Explorer, open the drop-down menu that appears in the top-right of the window, next to the Instant Search box. The menu is the one with the magnifying glass icon. From this menu, choose Manage Search Providers

In the new window that appears, click the Find more search providers link at the bottom.

This will open up a new web page where you can add various other pre-configured search providers, such as eBay, or Amazon.com. Scroll to the bottom of this webpage and click the link Create your own Search Provider

Clicking this link will open a different web page. Without closing this page, open a new instance of your browser and go to the webpage you want to add as a search provider. Using their search engine, search for the word TEST (make sure you enter it in uppercase) and wait for the results page to be displayed. As you can see in the example below, I went to the BBC News webpage and searched their site with the word TEST.

Once the results are displayed, go to the address bar at the top (highlighted in the below image in the wider red box) and select all the text that appears and then copy this text to the clipboard (press CTRL + C on your keyboard if you are unsure).

Return to the previous window, as shown below, and paste (press CTRL + V on your keyboard) the previously copied text into the URL field. Then, provide your own name for the search provider in the Name field. Then, simply press the Install Search Provider button to configure it into your browser.

If you are curious, you can click on the View XML link at the bottom of the page in order to see what is going on behind the scenes, as shown in this image.

You will be asked if you are sure you want to add the new search provider, and if you want it to be your default one. Take your pick, and then press Add.

Once added, you’ll see it appear in the list of search providers in Internet Explorer. You can now click on the close button to complete the process. It is worth noting that no software whatsoever has been installed on your computer. ALL that has happened is that Internet Explorer now has a cached copy of the XML file that you saw above, and uses this to provide the new search functionality. This is not an add-on to the browser that has been installed.

To use the new search provider is simple! Select it from the drop-down list in the top right of the browser window, input your search terms into the Instant Search box, and hit the Enter button on your keyboard! The browser will then load the page and display the results you were looking for!

This feature is incredibly useful because it allows you to extend the search functionality of Internet Explorer to include pretty much any website that offers the search feature. Importantly, this also includes any internal websites and portals that your company might have (using technologies such as Microsoft SharePoint for example), it doesn’t just have to be external sites. And, you’ll find that it will work with the majority of sites, not just the popular ones.

p.s. Why is the word TEST used? Well, this is simply so that Internet Explorer can then read the XML file and locate the part which is used for the search terms. The word TEST is then simply substituted for the search terms you specify!

Quicker Access to Windows 7 Virtual PC settings

Daniel Oxley — Sun, 09 Aug 2009 13:10:00 GMT

To edit the settings of a virtual computer using Virtual PC in Windows 7 requires the opening of the Virtual PC console, selecting the virtual machine you wish to edit, and then pressing the ‘Settings’ button, as shown in the screenshot below.

In order to reduce the number of required steps to do this (and assuming you know which file it is), you can edit a key in the registry that will add a new item to the Windows Explorer context menu that appears when right clicking on a file. If you make the changes detailed below, you will be able to right click on the settings file for a virtual machine (files with the .vmc extension) and access directly the settings window, as shown below.

Copy and paste the text between the lines below into a text file, but save it with the .reg file extension. Then double click on it to import it into the registry.

------------------------------------------------------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Windows.VirtualPC.VMC\shell\Settings]
@=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,56,00,\
4d,00,43,00,50,00,72,00,6f,00,70,00,65,00,72,00,74,00,79,00,48,00,61,00,6e,\
00,64,00,6c,00,65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,31,00,\
30,00,00,00
"Icon"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,56,00,\
4d,00,43,00,50,00,72,00,6f,00,70,00,65,00,72,00,74,00,79,00,48,00,61,00,6e,\
00,64,00,6c,00,65,00,72,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,30,00,\
30,00,39,00,00,00

[HKEY_CLASSES_ROOT\Windows.VirtualPC.VMC\shell\Settings\command]
@="vpcsettings.exe \"%1\""

------------------------------------------------------------------------------------------------------

As always, edit the registry at your own risk. I can’t be responsible for anything…

Saving The World, Printer Ink First

Daniel Oxley — Wed, 05 Aug 2009 14:08:00 GMT

Saving something seems to to be the big thing in I.T. at moment, which is never a bad thing. The current big thing is the Green Computing initiatives, particularly with the prominence now of virtual computing and power saving features in new operating systems (hint, hint: Windows Vista and Windows 7). Another very common one I see is the footer that a lot of people include on their emails, looks like this:

Well, a new one has appeared which on face value might seem a bit unbelievable, but the authors reckon that it actually really works. An open-source font has been created that looks like Swiss cheese!

The creators claim that, because the font is full of holes, you will save around 20% of the ink in your printer; thus saving money and resources. When I first saw it I was sceptical, but according to the website all those holes really do make a difference. I’ll give it a try to see how useful it is.

Note that, if your document has a lot of bold text then all those little holes will pretty much disappear, as you can see below:

Also, although it is called EcoFont, it doesn’t actually appear in your font list under that name which was a little confusing. It took me a while to find it (maybe this is in the documentation…) listed as Sprang eco sans.

You can get the font and read more about it here: http://www.ecofont.eu/splash_en_pro.html

Obviously, the better way to save ink in your printer (and paper as well) is to only print something when you absolutely have to. Countless times I have been onsite with clients and they have printed ALL of their documentation for me to read, which is such a waste as I could just as easily read it on screen if they simply email it to me. Also, when I submit documentation for review by customers, it is often printed out several times so people can go through it for reviewing; I know it is less comfortable to read off the computer screen, but still…

PowerShell Script ExecutionPolicy

Daniel Oxley — Wed, 05 Aug 2009 09:59:34 GMT

Seeing as PowerShell is included by default in Windows 7, and also because you get the PowerShell icon on your quick launch bar by default, I try to use that over the de rigueur cmd.exe command interpreter that we have all had since the dawn of time. Although, without thinking, I still often run cmd.exe just through habit :-S. I am only just starting out with PowerShell and I doubt I will ever achieve any success with the scripting, but you have to try!

The PowerShell icon on the quick launch bar

Right from the start, I had problems running a script I had written. Upon launching it I would get the below error returned:

File C:\Users\daniel\Desktop\copy.ps1 cannot be loaded because the execution of scripts is disabled on this system. Please see "get-help about_signing" for more details.
At line:1 char:19
+ C:\Users\daniel\Desktop\copy.ps1 <<<<

No matter what I tried, I just could not override the security settings that PowerShell had by default. Frustration prevailed with me cursing the point of making a scripting environment and the blocking the execution of scripts for security reasons. After hunting around, it turns out that this is simply a configurable option, and the default setting out of the box is the most secure one (as it should be). Simply running the following commands will change the setting and thus allow you to execute your scripts.

To view your existing setting, run the command: Get-ExecutionPolicy

To allow the execution of your scripts, run the command: Set-ExecutionPolicy RemoteSigned

Setting it to RemoteSigned means that you can run all of the scripts you write yourself, but not those downloaded from the Internet. Alternatively, if you set the execution policy to AllSigned then all scripts, including those you write yourself, have to be signed by a trusted publisher if you want to execute them. Otherwise, you can set it to Unrestricted and then all scripts will run, regardless of where they come from and whether or not they’ve been signed. This last setting is not the recommended one as you can open yourself up to “a world of pain” (a great film).

And if you need help understanding the script signing, you can run the command: Get-Help About_Signing

Application Installs, be gone!

Daniel Oxley — Wed, 17 Jun 2009 14:00:26 GMT

As a follow up to my earlier post about modularising my computer, I wanted to add a couple of points which I either missed out, or did not explain so well :-S

The first, which is a common question, is how to install Windows 7 into a VHD file without having to first install Window Server 2008 with Hyper-V onto a computer. You can read the details on how to do this with this blog post by Keith Combs; he has even created a webcast showing how it is done!

I mentioned that I try not to install applications into the operating system anymore, instead using App-V. What I forgot to mention is that, whenever possible, I try to use PortableApps as replacement for applications that I previously had to install. While not a perfect substitute, often these alternative applications give me all the functionality (and sometimes more) that I need. Also, by placing all these applications into a folder that I keep in Live Mesh, they are automatically copied down to my computer when it is reinstalled. It also allows me to share the application files between the two operating systems I have in a dual-boot setup without any duplication of files as they go into a separate partition and require no install process. Couldn’t be simpler!

This works both ways, an example of a good replacement is that of VLC Player replacing Windows Media Player. VLC has all the codecs you could ever imagine built into it, and offers pretty much the same functionality as Windows Media Player. However, trying to find a good replacement for Windows Live Messenger is pretty much impossible; the closest I have found so far is Pidgin, but it lacks an awful lot of functionality that Windows Live Messenger has.

IKEA-fying my computer

Daniel Oxley — Tue, 09 Jun 2009 01:50:00 GMT

I have had this blog post in the pipeline for a while now, but I have been waiting until all the pieces fell into place, to make it something actually worthwhile to read! Be warned though, this is a rather long blog post – but please stay awake!

Having access to earlier builds of Microsoft operating systems is great (and pretty important for my job given that I specialise in deploying them!) as I get to play with new technologies long before everyone else :-). The only downside to this though is that, seeing as I only have one company laptop, it means that every few months I am constantly formatting and reinstalling my computer. This is a task that everyone knows is painful; no matter how great the setup process of Microsoft Windows and then all the applications, it is still a couple of days work afterwards getting everything just right. Also, it is not as simple as just reinstalling Windows and applications as I always had to realise the following process:

Back up user data
Back up Outlook PST files
Back up Internet Favourites
Export all certificates for my user account
Export Bitlocker recovery keys
Burn DVD with latest version of Microsoft Windows
Format hard drive
Install operating system
Join computer to domain
Install all patches
Activate license for Windows
Install all applications, i.e. Office, FOXIT PDF, Anti-Virus, Visual Studio, Visio etc. etc.
Install more patches
Move user data, favourites, Outlook files, certificates and everything else back to internal laptop hard drive
Activate Bitlocker on hard drive (and re-encrypt C: partition)

It is such a tedious task that it would often put me off of changing the OS, particularly if I was away from the office travelling or did not have the time to do all of the above at home. And, after I had a Homer Simpson moment, I became paranoid that my backups were safe, so sometimes I made two copies of everything! What I wanted/needed was something a bit more ‘IKEA’-like; something modular that would allow me to swap pieces in and out easily without affecting the rest...

One day, on the way home from Barcelona on the train (trains are incredible in Spain by the way. From Madrid to Barcelona at 300 km/h without even noticing it) when I realised that, with a new feature in Windows 7 this was now possible! I have now been playing around the idea for a while and I wanted to blog about it, not so much that someone else might follow the steps (because it is far from painless at the moment, improving though) but because it shows the potential of what can be done right now with Windows 7 and existing software, and it might also be a common configuration one day in the future, who knows?

With Windows 7 a computer can boot using an operating system that is installed inside a VHD file, but the operating system is using the physical hardware of the computer – this feature is called “Boot from VHD” and has nothing to do with virtualisation apart from that it uses the VHD disk file format. What this means is that you can prepare a Windows 7 virtual machine in Hyper-V, execute sysprep and then copy the VHD file to a different computer and configure it to boot. The operating system inside the VHD file runs using all the physical hardware of the computer, but all operating system data remains inside the VHD file (think: container file, nothing more). Now, if my operating system is all contained inside a single file on the disk, here is the first step to making it modular; to change the operating system, I just need to copy a new VHD file to my hard drive and delete the unwanted VHD file or make it dual-boot.

This leaves me then with the problem of having to back up all user data before changing the operating system, and then restoring the data afterwards. But what if I configured Live Mesh to maintain a copy of my data in the cloud? By doing this, all I have to do is change the operating system, install the Live Mesh client agent and then sit back while all my user data reappears on my computer from the cloud. I won’t have had to make any backups, nor recover any files. My data is pulled down automatically from the online backup that Live Mesh maintains for me automatically and I can eliminate this pain from the process as well.

Now then, what about the reinstalling all of the applications every time? This is an easy one: if I package all of my applications into App-V “bubbles”, then I no longer need to reinstall any applications at all, all I do is just launch the application inside it’s bubble and I am up and running – no more application reinstalls and no need to worry about compatibility issues with a new operating system

In figure 1, I have represented the idea with a diagram. Every piece of the problem is contained inside it’s own module and can be swapped out easily, without affecting any other module – I can even change the underlying hardware, i.e. move to a new physical computer, with minimal effort now :-)

Figure 1: Welcome to the Oxley-verse

In figure 2 I show my drive partition schema, so that you can see that I have no operating system actually installed, it is all inside a VHD file (note the blue colour for icon on disk 1). Disk 0 has 2 partitions, excluding the initial RAW partition, the first (the D: drive) is the partition that holds the VHD file. It is not a bootable partition, and contains only a single file, the VHD file. In the M: drive partition on disk 0 I have all of my user data, application files, etc. This is important as, in order for this to work, the VHD must only contain the operating system and nothing else.

Disk 1 is the VHD file that is mounted at boot time, containing only my Windows 7 install.

Figure 2: Drive schema

Finally, by redirecting my entire user profile to the M: drive, I am not using the C: for anything other than the operating system. All of the user data, such as Favourites, documents, even temp files, etc. are redirected to M:. I have it all working great now, but it took an awful lot of work to get there. However, now that it is done, I can change my operating system (simply swapping out the VHD, fixing a few registry keys etc.) and be working with everything again within a couple of hours, as opposed to a couple of days. Beat that for efficiency!

Lessons learned:

As with all experimenting I learnt plenty of lessons, the hard way. Also, it is not totally modular yet, as certain pieces can’t be abstracted from the operating system; an example of this is the anti-virus software that still needs to be installed inside the VHD file and certain applications insist on writing to C:\Users\USERNAME. Below, I have listed the biggest problems that I came experienced, as well as some issues that need to be considered. The biggest issue I have seen though is not actually a technical one; some of the configurations are very very very likely to be unsupported by Microsoft and/or third party vendors. This doesn’t concern me too much because I am my own helpdesk, but it may be an issue in different environments.

Microsoft company policy states that any disk partition that contains confidential information must be protected with Bitlocker. As you can see in the drive schema above, M: is encrypted, and so is C:, which is inside the VHD file. Unless things change between now and the release of Windows 7, a Bitlocker’d “Boot from VHD” file is an unsupported configuration.
Likewise, I am pretty certain that Windows 7 in VHD on a computer that has no operating system installed ‘normally’ (i.e. the files on the disk rather than wrapped up in a VHD file) is also an unsupported configuration.
There is no 64 bit App-V client available yet.
Sequencing applications in App-V can be a fiddly job, and also not all applications can be sequenced.
There is allegedly a very slight loss of performance for Windows 7 running inside a VHD file when compared to a ‘normally installed’ Windows 7 computer. I would argue this point because, in my opinion, any performance degradation is either negligible or unnoticeable – but I am not refuting what Microsoft has published regarding this issue.
By default, the installation of Windows 7 will not create a paging file if it detects that a VHD file is being used to boot. It took me a while to work out why I couldn’t start any virtual machines on my computer due to lack of memory because of this. You can create a paging yourself, but you’ll need to create it on a partition outside the VHD file, in my case it is on the D: drive as it is the only partition not encrypted with Bitlocker.
Using standalone App-V packages requires a hefty amount of disk space because the packages are often larger than the space that a normal installation of the application would consume. Also, by carving up the local disk into partitions, I limited myself to the amount of space available.
App-V applications can take a little longer to start (unless caching is used) compared to an installed application.

After reading this, the obvious questions is “why not just put the OS into a different partition?”. My answer to this though is simple; doing it this way I can prepare the VHD file using Hyper-V at leisure without loosing access to everything else while I am doing it. If it takes 3 weeks, then that is no problem! Also, and importantly, I can put all the operating systems I want to boot into VHD files that all reside on the same partition. I am currently running a dual-boot configuration with Windows 7 in one VHD file, and Window Server 2008 R2 (with Hyper-V enabled of course) in another VHD file, with both VHD files on the same partition (D:).

If you try any of this on your computer, please don’t later on phone Microsoft support for help. Not unless they publish a support statement clarifying that the configuration is a supported one! This is simply an experiment I have been working on that works extremely well for me as I often reinstall my computer.

p.s. for those that don't know. IKEA is a mega super store that sells modular furniture that you take home and try to build yourself.

Safely setting autologon for Windows

Daniel Oxley — Wed, 22 Apr 2009 19:16:57 GMT

When configuring Microsoft Windows to auto-logon, most people just modify the following keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultDomain

However, the problem with doing it that way is that the password for the user account is stored in the registry as unencrypted text, which means that anyone with enough rights to view the registry, be it locally or remotely, can view the password easily and potentially compromise the system. This also applies if the computer was infected with a virus or malware, which could also potentially read the configured auto-logon user credentials and then send them over the internet for future malicious use.

However, if you use the Sysinternals tool AutoLogons to configure the auto-logon then the password string value is stored encrypted in the registry as an LSA secret. Which means that, once the autologon is configured, the unencrypted version of the password used cannot be viewed by anyone/anything at all.

The tool couldn’t be simpler to use, and most importantly, it helps to maintain the security of your systems.

Windows Server 2008 doesn’t have to ignore the MBSA if you don’t want it to

Daniel Oxley — Mon, 20 Apr 2009 10:28:52 GMT

The Microsoft Baseline Security Analyser (MBSA) is an excellent free tool by Microsoft that provides a simple and easy-to-use method of identifying common security misconfigurations for your Microsoft Windows computers. The current version (MBSA 2.1) runs on Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP and Windows 2000 and will scan all systems, most installed Windows components, and applications such as Internet Information Server (IIS) 5.0, 6.0 and 7.0, SQL Server 7.0, 2000 and 2005, Internet Explorer (IE) 5.01 and later, and Office 2000, 2002 and 2003.

A problem you might come up against however is that Windows Server 2008 computers by default have all the security settings turned on. Consequently, when you try to scan them, you see the below error appear in the MBSA console “Could not resolve the computer name: Please specify computername.”:

This is nothing to worry about and can be quickly remedied by enabling (only temporarily if necessary) the file sharing feature. To do this, just open the Network and Sharing Centre and select the radio button as displayed in the image below.

Once enabled, you can restart the scan and all should work correctly. So start checking your security right now by downloading the tool here: http://www.microsoft.com/downloads/details.aspx?familyid=F32921AF-9DBE-4DCE-889E-ECF997EB18E9&displaylang=en

I recommend that you read the Frequently Asked Questions page as there is some important information there, particularly if you wish to scan computers that don’t have internet connections (or connections that are perhaps restricted by a proxy server). The MBSA needs to download the latest security catalogue from Microsoft over the internet, but if the computer does not have internet access then the process will fail. In the FAQ are the instructions required in order to manually download the files from a different machine that does have internet access in order to manually update the catalogue on the computer running the MBSA.

Faster Creation of Virtual Machines

Daniel Oxley — Wed, 08 Apr 2009 09:55:49 GMT

I recently noticed a blog post on TechNet about a new tool that was released on CodePlex. WIM2VHD is a command-line tool allows you to create sysprepped VHD images from any Windows 7 installation source (and I suspect Windows Server 2008 R2 as well) that work with Virtual PC, Virtual Server, Microsoft Hyper-V, and Windows 7's new Native VHD-Boot functionality. Basically, you can create an entire virtual machine VHD file in minutes without have to go through the whole setup process of Windows. It is nice and simple to use, and after a brief moment of confusion I had it working fine :-)

To create my first VHD file, I ran the command: cscript.exe C:\Users\Administrator\Desktop\WIM2VHD.wsf /wim:e:\sources\install.wim /sku:Ultimate /vhd:U:\Hyper-V\Win7.vhd /size:12000 /disktype:Dynamic

However, this failed (as shown below) with the error “Error: 0: No filePath was specified”. After fiddling around with the command line to make sure that I was specifying the relevant paths, I realised that WIM2VHD was failing because it was unable to mount the WIM file from the Windows 7 DVD.

In order to mount WIM files, you first need to have installed the Windows Automated Installation Kit (WAIK), which you can get here: http://www.microsoft.com/downloads/details.aspx?familyid=4AD85860-D1F4-42A1-A46C-E039E3D0DB5D&displaylang=en. One thing to note is that I installed the beta version that was released for Windows 7. I do not actually know if the current 1.1 version will work with WIM2VHD, I imagine so. The 1.1 version can be found here: http://www.microsoft.com/downloads/details.aspx?familyid=94BB6E34-D890-4932-81A5-5B50C657DE08&displaylang=en

Once that was installed, I simply re-ran the previous command and, as you can see, had much more success!

This really is a great tool, as you can create virtual machines extremely quickly. And, the possibilities are endless because you could incorporate WIM2VHD into existing processes so that you could provision new computers easily and quickly on-the-fly using scripts.

Network Issues prevent certain Installations (otherwise known as 0xc000000f)

Daniel Oxley — Thu, 02 Apr 2009 12:28:17 GMT

I have recently been setting up a Hyper-V laboratory for a Windows 7 project. I had all the machines installed, and I was configuring them using an RDP connection rather than using VMConnect (the reason is that it is nice and easy to get access to files that are outside the VM this way, simply use \\tsclient\c (or any other drive letter) in order to get access to the C: drive of the local computer from the VM).

So, I popped the Microsoft Office 2007 DVD into the drive on my laptop in order to install it, but upon running setup.exe I was getting the below error:

As is sometimes the case, the error message was pretty useless. “The application failed to initialize properly (0xc000000f)” doesn’t really mean that much to me, and my first thought was that it was a problem with a scratched or dirty DVD. However, when I then tried to install some anti-virus software, I got the same exact error message, but this time I had launched the setup file from my local C: drive, thus eliminated dodgy media as the cause. A search on the web turned up no results at all (it seems that when Windows Vista fails to boot right it also displays the error 0xc000000f) apart from non-related issues.

In the end, I worked out that it seemed to be a problem with running the install over the network, because by copying the files inside the VM, all the applications installed correctly with no further fuss. Now, there is normally no issue at all with running an installation over the network (think SMS/SCCM) so I suspect that this is something specific to using the \\tsclient paths from RDP inside a virtual machine – either that or I completely did something wrong – this is always a possibility :-(